# Insider Threat Detection Using GCN and Bi-LSTM with Explicit and Implicit Graph Representations

arXiv: https://arxiv.org/abs/2512.18483 · HTML: https://mlsanity.com/paper/2512.18483/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 8 of its 39 references that are in the map.
- First posted on arXiv 20 Dec 2025.

## Builds on (most cited first, 8 of 8)

- [Modeling Relational Data with Graph Convolutional Networks](https://mlsanity.com/paper/1703.06103/) (2017)
- [Embedding Entities and Relations for Learning and Inference in Knowledge Bases](https://mlsanity.com/paper/1412.6575/) (2014)
- [Fast Memory-efficient Anomaly Detection in Streaming Heterogeneous Graphs](https://mlsanity.com/paper/1602.04844/) (2016)
- [Regularized Graph Structure Learning with Semantic Knowledge for Multi-variates Time-Series Forecasting](https://mlsanity.com/paper/2210.06126/) (2022)
- [Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data Streams](https://mlsanity.com/paper/1710.00811/) (2017)
- [Tiresias: Predicting Security Events Through Deep Learning](https://mlsanity.com/paper/1905.10328/) (2019)
- [LAN: Learning Adaptive Neighbors for Real-Time Insider Threat Detection](https://mlsanity.com/paper/2403.09209/) (2024)
- [ADSAGE: Anomaly Detection in Sequences of Attributed Graph Edges applied to insider threat detection at fine-grained level](https://mlsanity.com/paper/2007.06985/) (2020)

## Built on by (most cited first, 1 of 1)

- [Multi-Axis Trust Modeling for Interpretable Account Hijacking Detection](https://mlsanity.com/paper/2603.13246/) (2026)

## Abstract (arXiv)

Insider threat detection (ITD) is challenging due to the subtle and concealed nature of malicious activities performed by trusted users. This paper proposes a post-hoc ITD framework that integrates explicit and implicit graph representations with temporal modelling to capture complex user behaviour patterns. An explicit graph is constructed using predefined organisational rules to model direct relationships among user activities. To mitigate noise and limitations in this hand-crafted structure, an implicit graph is learned from feature similarities using the Gumbel-Softmax trick, enabling the discovery of latent behavioural relationships. Separate Graph Convolutional Networks (GCNs) process the explicit and implicit graphs to generate node embeddings, which are concatenated and refined through an attention mechanism to emphasise threat-relevant features. The refined representations are then passed to a bidirectional Long Short-Term Memory (Bi-LSTM) network to capture temporal dependencies in user behaviour. Activities are flagged as anomalous when their probability scores fall below a predefined threshold. Extensive experiments on CERT r5.2 and r6.2 datasets demonstrate that the proposed framework outperforms state-of-the-art methods. On r5.2, the model achieves an AUC of 98.62, a detection rate of 100%, and a false positive rate of 0.05. On the more challenging r6.2 dataset, it attains an AUC of 88.48, a detection rate of 80.15%, and a false positive rate of 0.15, highlighting the effectiveness of combining graph-based and temporal representations for robust ITD.